Steven Parker
Giga Sage

‎06-09-2023 08:07 AM - edited ‎06-09-2023 08:09 AM

Security Operations has it's own Inbound Actions called "Email Parsing".  If you want to create Security Incident from emails received, you need to build your inbound action on the "Email Parser" table.

StevenParker_0-1686323198728.png

 

You will find more details in this post:

https://www.servicenow.com/community/secops-forum/security-incident-inbound-email-action-has-a-confu... 


Please mark this response as correct and/or helpful if it assisted you with your question.
Steven

newbie_05
Tera Contributor
In response to Steven Parker

‎06-09-2023 08:13 AM

Thank you 

 

Have you done this before, if so would you point me to how to as this one is new to me 

 

I just need to create  the ticket with the basic information prefilled like the requested by, short description etc and for it to be assigned to a group 

0 Helpfuls

Steven Parker
Giga Sage
In response to newbie_05

‎06-09-2023 08:47 AM - edited ‎06-09-2023 08:49 AM

Sure...here is an example of a Malware one we use.  You basically create the parser and then create field transforms which are essentially "How do you want to populate the fields on the SIR":

StevenParker_0-1686324499574.png

 

Here are some of the transforms if that helps:

StevenParker_1-1686325620762.png

 

StevenParker_2-1686325630304.png

 

StevenParker_3-1686325637453.png

 

StevenParker_4-1686325644138.png

(with the Value Prefix you can specify which words to look for in the email and grab the value after that as shown above)

 


Please mark this response as correct and/or helpful if it assisted you with your question.
Steven

View solution in original post

0 Helpfuls

newbie_05
Tera Contributor
In response to Steven Parker

‎06-11-2023 07:26 PM

Just wanted to touch base with you quickly on this 

 

I have done email parser, however the ticket is still created as an INC ticket and not a SI ticket 

I also wanted the assignment group to be prefilled, this field will be static with one particular assignment group.  

newbie_05_0-1686536463619.png

Why is my assignment group field not populating with the assignment group I selected and why is the incident being created as INC and not SI even though 

0 Helpfuls

Steven Parker
Giga Sage
In response to newbie_05

‎06-12-2023 05:17 AM

Are you sure your other normal inbound action is disabled and isn't creating a record on the Incident table?  Email Parser by default creates records on the sn_si_incident table as shows in the "Destination Table" field in your screenshot above.

 

As for Assignment Group, we use the same group for every SI Incident, but I assume you would choose that field, always a static value, and then place the sys_id of the assignment group in the static value field?


Please mark this response as correct and/or helpful if it assisted you with your question.
Steven
0 Helpfuls